Security defaults
Start from an environment where every password is generated and every request is recorded.
A new environment generates every password that you do not set and records traffic in the audit log from the first request.
Passwords and accounts
A password that you do not set is generated as a uuid4 or an equivalently strong secret, so a new environment has no published default.
The accounts that a new environment has, and where each is documented:
| Account | What it is for | Where |
|---|---|---|
admin | The Dashboard - its password is Zato_Dashboard_Password | Dashboard authentication |
zato | SSH access to the container - the user does not have and does not need sudo powers | Environment variables |
ide_publisher | Deploying code from an editor | Environment variables |
To change any of them later, see changing passwords.
API credentials
Default API users are HTTP Basic Auth definitions. You find them in the Dashboard under Security → HTTP Basic Auth, and each new security definition that you add joins them there. The /metrics Prometheus endpoint has a separate Basic Auth definition, with the password from Zato_Metrics_Password.
Channels
- A channel that you create yourself is only as protected as the security definition you assign it - a channel with none is open to anyone who can reach its port. To assign one, see channel security.
- The built-in firewall is on with no configuration, blocking requests for the URL paths listed in the environment's blocked-paths file.
Recording
The audit log is on for every new channel, connection and topic, so there is a record from the first request - for what the log keeps and for how long, see the audit log.
What you configure yourself
These settings have no useful default, so you set them:
- Whether TLS is on and which ports are published
- Who reaches the Dashboard
- Which channels are open and which are rate limited
- How long payloads are retained and whether they leave the container
The production best practices rank them by importance.
See also
see-also-table
columns: [Page, What it covers]
rows:
- page: docs/admin/production-best-practices
text: Production best practices
note: The pre-production configuration that follows from the defaults
- page: docs/admin/security/change-password
text: Changing passwords
note: Replacing the generated passwords with your own
- page: docs/admin/security/channel
text: Channel security
note: Assigning security definitions to the channels that you create